{{ message }}
Repository navigation
Add reusable relock workflow for Dependabot PRs - #63
Merged
Merged
Conversation
Adds two workflows: - relock.yml: reusable workflow_call that installs gh-actions-lock, re-pins the lockfile with --no-onboard --no-interactive, and commits the updated actions.lock back to the PR branch. - dependabot-relock.yml: thin caller that triggers on pull_request from dependabot[bot] and delegates to relock.yml.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
⚠️ Not ready to approve
The workflows as written will not reliably run and push updates back to the PR branch due to invalid runner selection and missing/incorrect ref + permissions wiring for workflow_call.
Pull request overview
Adds automation to keep .github/workflows/actions.lock up to date when Dependabot updates action versions in workflow files, by introducing a reusable relock workflow plus a Dependabot-only caller workflow for dogfooding in this repo.
Changes:
- Introduces a reusable
workflow_callworkflow that runsgh actions-lockand commits/pushesactions.lockback to the PR branch. - Adds a
pull_request-triggered workflow that runs only fordependabot[bot]PRs and delegates to the reusable workflow.
File summaries
Copilot's findings
- Files reviewed: 2/2 changed files
- Comments generated: 4
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Read-only check (--no-fix) that fails if actions.lock is out of sync with the workflow files. Runs on ubuntu-slim.
The repo is internal so gh extension install fails from the runner's GITHUB_TOKEN. Build from source like the other jobs do.
ubuntu-slim (Hosted Compute Docker image) doesn't expose GITHUB_TOKEN in a way that gh extension install picks up. Set GH_TOKEN explicitly.
The CLI needs a token to resolve action refs via the GitHub API. ubuntu-slim doesn't expose GITHUB_TOKEN in a way the go-gh library picks up automatically.
Adds relock.yml to tracked workflows and upgrades lockfile schema from v0.0.1 to v0.0.2.
Reverts the premature lockfile update so the lint job can demonstrate failure output. Reworks lockfile-lint to produce: - Annotated error lines per finding (::error file=...) - Grouped workflow status summary - Lockfile diff showing what a fix would change - Job summary with findings table
Consumers use github/gh-actions-lock/actions/lint@main after merge. For CI in this repo, ./actions/lint resolves correctly.
Replaces hardcoded local-action exemption with a configurable ignore-categories input. Categories in the list become warnings instead of blocking errors. No special cases in the script.
This reverts commit 57356c9.
GitHub Actions fails to parse the workflow when a composite action references itself. ./actions/lint is the correct pattern for self-testing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When Dependabot bumps an action version in a workflow file, the
actions.locklockfile goes stale. This adds a reusable workflow that automatically re-pins the lockfile and commits it back to the PR branch.How it works
relock.ymlis aworkflow_calltarget that:gh-actions-lockfrom this repo's releasesgh actions-lock --no-onboard --no-interactiveto re-pin changed depsactions.lockif anything changedIt accepts an optional
extra-flagsinput for things like--allow-runners.dependabot-relock.ymlis a thin caller that triggers onpull_request, gates ondependabot[bot], and delegates to the reusable workflow. This repo dogfoods it.Permissions
The workflow declares
permissions: contents: write, which elevates theGITHUB_TOKENfor Dependabot-triggered runs (Dependabot PRs get read-only by default). No separate PAT or Dependabot secret needed --GITHUB_TOKENis auto-set in the runner env andghreads it natively.Consumer usage